From 492 passengers to a sellable machine: the whole road — proof, platform, product — with every phase carrying its done-line, its receipts, and exactly what stays in your hands.
Draft for annotation · not approved · nothing new builds from this page yet
The one non-negotiable: the fleet stays the critical path the whole way. A case study of an unfinished migration sells nothing — every product ambition below feeds on the proof, never competes with it.
The three summits
I. The Proof — 492 veterinary practices migrated faithfully, cut over safely, and promise-kept, with every claim recomputable by a stranger. II. The Platform — the Promise Ledger: for every site, every promise we make carries a live measurement, a freshness clock, a loud breach path, and a page where anyone can see it; broken promises feed a machine that drives them to zero. III. The Product — the migration compiled into a case study no competitor can fake (because every claim links to a receipt a skeptic can re-run), the operator console grown from Alie's real tools, the promise catalog priced as the guarantee menu an agency resells — and the pipeline sold to web agencies.
The summits are sequential in proof but overlapping in work: the same acts that finish the fleet build the platform, and the product's evidence accretes from tonight via the case-study ledger.
↘ go deeper — provenance and the deeper-plan question
Authored on Robert's word 2026-08-29 night ("we'll ultimately sell the neuron pipeline to other web agencies… can you create the full end state plan yourself?"). Extends, never replaces, the ratified site-level end state (docs/ai/the-end-state.md) and the three goals (docs/ai/GOALS.md). The constitution's deeper-plan question, answered in writing: this plan is the surface of exactly one deeper plan — prove that agents can hold something real in trust at fleet scale, and make that proof purchasable. The six-truths preamble named the practices "the first passengers" in July; this document is who the flight was always for. Canonical Markdown: ~/next-arc/END-STATE-PLAN-2026-08-29.md.
The road, as one journey
P0 · Where we stand tonight. Forms live and proven end-to-end with your own inbox sighting; the cured worker deployed by your hand; eight proven trunk landings today; fifteen court verdicts standing, including the one the court vacated in its own record; the four-lieutenant command model in force. Wounds named, not hidden: the blind CI referee, the six dead sites honestly "cause unknown," the box capability gap.
↘ go deeper — the baseline numbers
Coverage debt 97→79 and typed (wolf-proven / fixture-exercised / unreachable-as-configured). Lead 23494a9c human-sighted; worker cbe4a292 desk-verified live. Commander model + courts-in-every-box ratified today; capability-parity build chartered (warp#665, death-detector first). Known instrument outages: fast-lane #156 (CI referee blind), sandbox lane private/local doors (warp#660/#670).
P1 · The factory runs honest. Any practice URL exits machine-green or with a whole-truth bill, unattended. The error-to-zero cycle becomes the line's standing metabolism — every erroring build enumerates itself, traces, opens its cure, re-verifies, forever. The dead-site backlog drains to zero-or-named. The inspector's judgment passes its court and the fleet is re-graded, so "ready to launch" becomes a number nobody has to believe.
↘ go deeper — owners, receipts, your holds
Owners: the Loop and Launchable lieutenants (arcs 1–3). Receipts: per-site rerun receipts with the three-outcome grammar (green / still-red-same = cure's scope claim wrong, loudest / still-red-other = unmasked second defect); the cycle's invoker firing unforced on a real erroring build with the wiring mandate's red-proof; the re-graded fleet table with per-site evidence paths. Your holds: none routine — frame calls only.
P2 · Cutover becomes a cadence. The risk register you re-shaped tonight gets your red pen: every enumerated failure mode carries an automated probe or a named human step, and the undo path is proven before it's ever needed. The routing law goes live: a site's forms point at the test inbox until the moment it cuts over, then at the clinic — derived from cutover state itself, so the destination cannot disagree with reality — with a works-end-to-end proof at every flip. First real practices cross; then waves, on a rhythm the line sustains. This is the load-bearing phase: everything before it feeds it, everything after it stands on it.↘ go deeper — owners, receipts, your holds
Owner: the Cutover-and-Watch lieutenant (arc 4). Receipts: per-cutover proof bundles — redirect list verified, forms flip proven, contact facts consistent everywhere, rollback tested; the register page with probe status per row. Your holds: the register red pen · the first-wave GO · the recipient fan-out word · drill scheduling for whatever automation can't prove.
P3 · The Promise Ledger, version one. The catalog — currently under five-lens research plus your red pen — is ratified with your thresholds. Every ratified promise gets its row: a live probe where we can build one now (uptime, certificate and domain runway, Google index state, redirects, byte-drift, the forms canary read back from a real mailbox, the money-widgets mounting), and an honest loud UNWATCHED marker where we can't yet. The watchdogs arm on the ratified sequence. No promise anywhere in the fleet is silently unmeasured.
↘ go deeper — owners, receipts, your holds
Owners: Cutover-and-Watch (probes, arming) + Team (the surface). Receipts: the per-site promise board; each probe's both-directions proof — caught a planted breach, passed a healthy site, says "I broke" in its own typed voice; breach→cure rows flowing into the error-to-zero cycle. Your holds: catalog ratification · thresholds in your words ("fast means ___," "an enquiry has ___ minutes") · arming words · the read-only ledger credential at arming, not before.
P4 · The team drives (runs parallel from tonight, matures here). Alie runs her whole see-it → flag-it → see-it-fixed loop with no engineer in it; the forms trust surface and the promise board are her daily tools; your board draws itself from records; the case-study ledger accretes a row per landing as a standing habit. Alie is, quietly, the prototype agency operator — every surface built for her is a page of the eventual product.
↘ go deeper — owners, receipts, your holds
Owner: the Team lieutenant (arc 6). Receipts: one full Alie loop executed end-to-end with zero desk touches; the board's auto-draw diffed against hand-kept truth for a week before the hand lets go. Your holds: the trust-surface mock red pen; nothing else.
P5 · Neuron proper — the second pass. Your ruling (2026-08-29 evening): edit time is not the critical path. The fast line moves the sites because hosting deadlines force the move — no cutover waits on an editing guarantee. When the neuron genome and edit work is done, the fleet re-runs through neuron proper, and that pass enforces the editing guarantees: a practice URL becomes a certified, editable site in under thirty minutes; an asked-for edit is live in under sixty seconds with a receipt and an undo; and the wand gauntlet — twelve blind asks written by someone who didn't build the system — scores twelve for twelve, judged by a walk, not a test suite. Visitor speed stays promised relative to the site we took over, never as an absolute bar on a faithful copy.
↘ go deeper — owners, receipts, your holds
Owners: all four lieutenants + desk (this is GOALS.md becoming measured). Receipts: clock measurements with per-stage attribution so a miss names its stage; the gauntlet walk report as the closing artifact. Your holds: authoring or blessing the twelve blind asks; renegotiating any missed clock loudly, measurements in hand — never silently.
P6 · The product ships. The case study compiles itself from the ledger — every sentence linking to a receipt a skeptical agency owner can re-run, a category of one in an industry that sells screenshots. The operator console is cut from Alie's proven surfaces, the guarantee menu from the ratified catalog with measured attainment across the fleet. Packaging — licensing, hosting, tenancy, support — is chartered here and only here. A first agency runs as passenger #493, with the same receipts the vets got.
↘ go deeper — owners, receipts, your holds
Owners: you + desk + Team lieutenant. Receipts: the case study artifact itself; the pilot agency's own promise board going green. Your holds: everything commercial — pricing, pilot selection, positioning, the case study's public face. The machine's job in this phase is singular: every sentence you want to say to a buyer is already true and provable before you say it.
Invariants — bind every phase, never trade against the clocks
No false greens; the reviewer is never the author; receipts a stranger can recompute; verdicts are testimony. Every checker proven in both directions — catches a planted breach, passes healthy work — and required to say "I broke" in its own voice. A name is not a role (minted tonight): verification binds to what a thing does, never to what it's called. Absence is a first-class loud claim, never a quiet skip. Live-surface acts always reach a human hand; consequential commands arrive singly and legibly. Lieutenants self-fire under objectives; the desk rules, routes, and folds; idle is a lieutenant's alarm. Everything you read arrives in business terms.
Risks, named
Google reachability at cutover scale — highest consequence, least in-house control; P2's register treats it as first-among-risks. Per-clinic email deliverability at fan-out — sender reputation may need its own hardening round. The six-site unknown — may hide a deeper line defect. Box capability timeline — gates how much lieutenants execute unaided. Third-party widget breakage — perpetual; the money-widget probe is containment, not cure. Receipt hygiene over months — the case study's power depends on it; the ledger habit is the mitigation.
Explicitly not now
Multi-tenant architecture, licensing and packaging engineering, public marketing surfaces, additional verticals, any P6 build — frozen until P2 is a cadence and P3's board exists. The fleet is the proof; the proof is the product.
Your red-pen targets
Does the ordering hold? — RULED, 2026-08-29 evening
Edit time is off the critical path entirely: the fast line moves sites under hosting deadlines, and editing guarantees are enforced later, on the neuron-proper re-run (P5 rewritten to match). The edit-clock never pulls forward as demo material.
Is the freeze list right?
Everything commercial is parked until the cadence is real. If anything on the not-now list should thaw earlier — a landing page, early agency conversations, a teaser of the case study — name it and it gets its own worded charter.
Passenger #493 — right shape for the pilot?
The plan treats the first agency as one more passenger run through the same machine with the same receipts. If you'd rather pilot differently — white-glove alongside, or a single joint client first — that reshapes P6's back half.